What this tool does
Paste a token and it verifies the signature against a key you provide — the algorithm is read straight from the header, and the input below switches automatically between a secret field (HMAC) and a public key field (RSA/ECDSA), so you don't have to figure out which one applies.
Supported algorithms
- HS256, HS384, HS512 — HMAC, verified with the same shared secret that signed the token.
- RS256, RS384, RS512 — RSASSA-PKCS1-v1.5, verified with the issuer's RSA public key.
- ES256, ES384, ES512 — ECDSA (P-256/P-384/P-521), verified with the issuer's elliptic-curve public key.
RS256 and ES256 are what most identity providers (Auth0, Okta, Firebase, AWS Cognito, Google) issue by default — this is the one JWT tool on this site that can check those. RSA-PSS (PS256/384/512) and alg: none aren't supported.
Public keys are safe to paste here — private keys are not
A public key is, by definition, safe to share; verifying a token only ever requires the public half of a key pair, never the private key that signed it. This tool only ever asks for a public key (PEM, SPKI format — the -----BEGIN PUBLIC KEY----- block most JWT libraries export). If a tool ever asks you to paste a private key to "verify" a token, that's a sign something is designed wrong.
FAQ
Where do I get the public key?
From whoever issued the token — most identity providers publish their public keys at a /.well-known/jwks.json endpoint, or you can export the public half of a key pair you control yourself.
I want claim explanations and expiration checks too
This tool is deliberately narrow — signature verification only. For automated security findings, decoding, and expiry status in one place, see the JWT Inspector (HMAC only) or pair this with the JWT Claims Viewer and JWT Expiration Checker.
Is my key or token sent anywhere?
No — verification happens entirely in your browser using the Web Crypto API. Nothing is uploaded.